prelude and samhain...

Hello,
    I'm installing samhain on several servers as clients to a samhain
logserver (yule) which is registered as a prelude analyzer.
    The idea is to concentrate all logs to a unique prelude analyzer,
instead of one analyzer per server.
    Its working fine, i can see the reports on prelude via prewikka.

    But the messages are disappointing as they are not meaningful:
1 x CRIT : [2010-04-06T11:59:30+0100] msg= (succeeded
<https://monit02.net.ipp.pt/prelude?view=alert_listing&orderby=time_desc&alert.assessment.impact.completion=succeeded&alert.type=alert.correlation_alert.name&alert.type=alert.create_time&alert.type=alert.overflow_alert.program&alert.type=alert.tool_alert.name&aggregated_target=alert.target%280%29.node.address%280%29.address&aggregated_analyzer=none&aggregated_source=alert.source%280%29.node.address%280%29.address&timeline_value=1&auto_apply_value=1%3A00&timeline_unit=hour&limit=50&alert.assessment.impact.severity=high&alert.assessment.impact.severity=info&alert.assessment.impact.severity=low&alert.assessment.impact.severity=medium&alert.assessment.impact.severity=n%2Fa&auto_apply_enable=false&timezone=frontend_localtime&aggregated_classification=none>)

1 x CRIT : [2010-04-06T11:59:30+0100] msg=(succeeded
<https://monit02.net.ipp.pt/prelude?view=alert_listing&orderby=time_desc&alert.assessment.impact.completion=succeeded&alert.type=alert.correlation_alert.name&alert.type=alert.create_time&alert.type=alert.overflow_alert.program&alert.type=alert.tool_alert.name&aggregated_target=alert.target%280%29.node.address%280%29.address&aggregated_analyzer=none&aggregated_source=alert.source%280%29.node.address%280%29.address&timeline_value=1&auto_apply_value=1%3A00&timeline_unit=hour&limit=50&alert.assessment.impact.severity=high&alert.assessment.impact.severity=info&alert.assessment.impact.severity=low&alert.assessment.impact.severity=medium&alert.assessment.impact.severity=n%2Fa&auto_apply_enable=false&timezone=frontend_localtime&aggregated_classification=none>)

1 x ALERT : [2010-04-06T11:59:27+0100] msg=(succeeded
<https://monit02.net.ipp.pt/prelude?view=alert_listing&orderby=time_desc&alert.assessment.impact.completion=succeeded&alert.type=alert.correlation_alert.name&alert.type=alert.create_time&alert.type=alert.overflow_alert.program&alert.type=alert.tool_alert.name&aggregated_target=alert.target%280%29.node.address%280%29.address&aggregated_analyzer=none&aggregated_source=alert.source%280%29.node.address%280%29.address&timeline_value=1&auto_apply_value=1%3A00&timeline_unit=hour&limit=50&alert.assessment.impact.severity=high&alert.assessment.impact.severity=info&alert.assessment.impact.severity=low&alert.assessment.impact.severity=medium&alert.assessment.impact.severity=n%2Fa&auto_apply_enable=false&timezone=frontend_localtime&aggregated_classification=none>)

1 x CRIT : [2010-04-06T11:59:31+0100] msg=(succeeded
<https://monit02.net.ipp.pt/prelude?view=alert_listing&orderby=time_desc&alert.assessment.impact.completion=succeeded&alert.type=alert.correlation_alert.name&alert.type=alert.create_time&alert.type=alert.overflow_alert.program&alert.type=alert.tool_alert.name&aggregated_target=alert.target%280%29.node.address%280%29.address&aggregated_analyzer=none&aggregated_source=alert.source%280%29.node.address%280%29.address&timeline_value=1&auto_apply_value=1%3A00&timeline_unit=hour&limit=50&alert.assessment.impact.severity=high&alert.assessment.impact.severity=info&alert.assessment.impact.severity=low&alert.assessment.impact.severity=medium&alert.assessment.impact.severity=n%2Fa&auto_apply_enable=false&timezone=frontend_localtime&aggregated_classification=none>)

1 x CRIT : [2010-04-06T11:59:30+0100] msg=(succeeded
<https://monit02.net.ipp.pt/prelude?view=alert_listing&orderby=time_desc&alert.assessment.impact.completion=succeeded&alert.type=alert.correlation_alert.name&alert.type=alert.create_time&alert.type=alert.overflow_alert.program&alert.type=alert.tool_alert.name&aggregated_target=alert.target%280%29.node.address%280%29.address&aggregated_analyzer=none&aggregated_source=alert.source%280%29.node.address%280%29.address&timeline_value=1&auto_apply_value=1%3A00&timeline_unit=hour&limit=50&alert.assessment.impact.severity=high&alert.assessment.impact.severity=info&alert.assessment.impact.severity=low&alert.assessment.impact.severity=medium&alert.assessment.impact.severity=n%2Fa&auto_apply_enable=false&timezone=frontend_localtime&aggregated_classification=none>)


Does anyone have experience with this?
Thanks.

--
Jaime Ventura
-------------------------------------
Serviços de Informática e Comunicação
Segurança e Administração de Sistemas

Instituto Politécnico do Porto
Rua Dr Roberto Frias, 712
4200-465 PORTO 

E-mail: [email protected]
Telefone:  225 571 000 (Ext. 1251)
Telemovel: 961 789 569 
Fax:       225 020 772

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user